CVE-2026-33613
Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.50% probability · 41th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- mbconnectline/mbconnect24 · mbconnectline/mymbconnect24
- Source
- info@cert.vde.com
References
- https://certvde.com/de/advisories/VDE-2026-030Third Party Advisory
- https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-030.jsonVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.